Threat Update

Coordinated Cyberattack Hits 30+ Minnesota Water Systems

A coordinated cyberattack targeted the operational technology (OT) of more than 30 community water systems across Minnesota between July 26 and 27, 2026. While the full list of impacted utilities remains confidential, four cities—Braham, Plymouth, South St. Paul, and Maple Plain—have publicly confirmed their systems were targeted.​

The attackers specifically went after automated control functions and equipment connected via cellular communications. In Braham, the attack shut down the well and water treatment plant controls, taking the facility offline for a few hours. In Plymouth, cellular communications at two water towers and multiple wastewater lift stations were disrupted.​

Despite the disruption to automated systems, state and federal authorities confirmed that drinking water remained safe and public health was not impacted. Contingency plans were successfully activated across the affected cities, and operators were able to maintain services by transitioning to manual workarounds.​

The Minnesota IT Services (MNIT) and federal partners are currently investigating the incident. While formal attribution has not been finalized, the attacks occurred shortly after federal warnings regarding Iranian-affiliated hackers targeting industrial control systems in the U.S. water sector.

V. 1.16

By subscribing, you agree to our Privacy Policy, Refund Policy and Terms of Service.